December 2003 - cypherpunks-legacy

Re: Crypto reg clarification from Commerce Department
by Greg Broiles 17 Dec '03

17 Dec '03

Lucky Green wrote: >I just got of the phone with Bruce Kutz, Export Policy Analyst, Office of >Strategic Trade and Foreign Policy Controls. (202) 482-0092. He seems to be >the contact person for the new regs. Well done, Lucky. This is what's needed to kick off a lot of commentary during the next 45-days. Backed by research, to be sure. The outpouring of such commentary on the full EAR from May 1995 to March 1996 shaped the final document, and that process is an excellent case study for how to affect the final form of the latest crypto regs. It's worth perusing the full EAR in the Federal Register: March 25, 1996 (Volume 61, Number 58), Pages 12713 et seq. for 325 pages (well over a 2.5MB -- it's also on our site, see URL below). Here's the portion of the EAR that Lucky and Kutz discussed: [Page 12805] Sec. 744.6 Restrictions on certain activities of U.S. persons. (a) General prohibitions--(1) Activities related to exports. (i) No U.S. person as defined in paragraph (c) of this section may, without a license from BXA, export, reexport, or transfer to or in any country other country, any item where that person knows that such item: (A) Will be used in the design, development, production, or use of nuclear explosive devices in or by a country listed in Country Group D:2 (see Supplement No. 1 to part 740 of the EAR). (B) Will be used in the design, development, production, or use of missiles in or by a country listed in Country Group D:4 (see Supplement No. 1 to part 740 of the EAR); or (C) Will be used in the design, development, production, stockpiling, or use of chemical or biological weapons in or by a country listed in Country Group D:3 (see Supplement No. 1 to part 740 of the EAR). (ii) No U.S. person shall, without a license from BXA, knowingly support an export, reexport, or transfer that does not have a license as required by this section. Support means any action, including financing, transportation, and freight forwarding, by which a person facilitates an export, reexport, or transfer without being the actual exporter or reexporter. (2) Other activities unrelated to exports. No U.S. person shall, without a license from BXA: (i) Perform any contract, service, or employment that the U.S. person knows will directly assist in the design, development, production, or use of missiles in or by a country listed in Country Group D:4 (see Supplement No. 1 to part 740 of the EAR); or (ii) Perform any contract, service, or employment that the U.S. person knows directly will directly assist in the design, development, production, stockpiling, or use of chemical or biological weapons in or by a country listed in Country Group D:3 (see Supplement No. 1 to part 740 of the EAR). (3) Whole plant requirement. No U.S. person shall, without a license from BXA, participate in the design, construction, export, or reexport of a whole plant to make chemical weapons precursors identified in ECCN 1C350, in countries other than those listed in Country Group A:3 (Australia Group) (See Supplement No. 1 to part 740 of the EAR). (b) Additional prohibitions on U.S. persons informed by BXA. BXA may inform U.S. persons, either individually or through amendment to the EAR, that a license is required because an activity could involve the types of participation and support described in paragraph (a) of this section anywhere in the world. Specific notice is to be given only by, or at the direction of, the Deputy Assistant Secretary for Export Administration. When such notice is provided orally, it will be followed by a written notice within two working days signed by the Deputy Assistant Secretary for Export Administration. However, the absence of any such notification does not excuse the exporter from compliance with the license requirements of paragraph (a) of this section. (c) Definition of U.S. person. For purposes of this section, the term U.S. person includes: (1) Any individual who is a citizen of the United States, a permanent resident alien of the United States, or a protected individual as defined by 8 U.S.C. 1324b(a)(3); (2) Any juridical person organized under the laws of the United States or any jurisdiction within the United States, including foreign branches; and (3) Any person in the United States. (d) Exceptions. No License Exceptions apply to the prohibitions described in paragraphs (a) and (b) of this section. (e) License review standards. Applications to engage in activities otherwise prohibited by this section will be denied if the activities would make a material contribution to the design, development, production, stockpiling, or use of chemical or biological weapons, or of missiles. ----- The EAR covers all kinds of exports, so encryption and cryptography provisions are found by searching. The Federal Register published it in seven 50 page chunks, and is available at: http://www.access.gpo.gov/su_docs/aces/aces140.html Enter the search term: "Page 12713" (with quotes; repeat six times in sequence). We've combined the seven parts for searching: http://jya.com/ear032596.txt (2,570K)

1 0

One-time pads
by nobody＠replay.com 17 Dec '03

17 Dec '03

The arrival of warm weather is heralded by the pig shit (or whatever kind of shit Intel swines have for brains) getting soft in Timmy C[rook] Mayhem's mini-cranium and the resulting green slime seeping through his cocaine- and syphilis- damaged nose and onto his keyboard. o_, o <\__, v|> Timmy C[rook] Mayhem | < \

1 0

How to Reach The Most People
by iolkos＠ix.netcom.com 17 Dec '03

17 Dec '03

Targeted E-Mail Lists Will Get Your Message Out You probably have a special offer to make to many people over the internet. At ATS Publishers, Inc., we maintain a database of over 450 groups of e-mail addresses sorted according to the groups' demographic, psychographic, geographic, benefits-sought, and individual description. If you have a book, product, announcement, or service to advertise in a specific area, your greatest response rates will come from targeting these niche lists. You must have these addresses, as you will save money while no longer mailing your sales message to unqualified prospects. We absolutely guarantee your success with these lists. Here is a small sample: Opportunity Seekers, General Business, Sports (all), Entrepreneurship, Fitness & Exercise, Accountants, Health, Lawyers & Legal, Nutrition, Single Moms, Fashion, Outdoors, Dresswear, Computers, Math & Sciences (all), Finance, Investing, Fishing, Hunting, Hunting Dogs, Financial Markets, Race Boats, Wealth, Taxes, Languages, Millionaires, Divorced Parents, Gay & Lesbian, Kids, Teenagers, Adults, Seniors, Racial-Ethnic-Cultural (all), Criminal, Pornography, Shopaholics, Alcoholics, Virgins, Politics, Overweight, Paranormal, Psychology, Literature, Technical, Painters & Artists, Doctors & Medicine, Religion & Atheism, Government, Taxation, Food and Beverages, Wines & Spirits, Restaurants, Working Women, Geographical U.S., Sex, Physically Challenged Persons, Drugs, Hippies, Music and Musicians, Firearms, Militias, Students, AIDS, Disorders, Child & Baby Care, Feminists, Body Painting & Piercing, Massage, Activists, Homeowners, Real Estate, Automotive, Health Care, Insurance, Edu! cation, Infertility, Architects, Dating, Love, Telecommunications, Hardware & Tools, Homes & Gardening, S&M, Housekeeping, Spirits & Wines, Home Business, Star Trekkies, Athletes, Authors, Store Owners, Job Hunters, Photography, Plants, and another 350 groups targeted even further... If you do not see your group in these listings, don't worry! Even if they are not in our database, we will create one for you within 24 hours. Here's how to order: Write us a brief description of the groups you want to target. We will then ship you, in diskette form, a listing of the 10,000 most targeted prospects for your product. These are people who have PROVEN beyond any doubt that they are interested in the service you are offering. Each e-mail listing of 10,000 names costs only $19.95. And although $19.95 is our minimum order, you may buy in odd lots also, say, 15,000. Each additional name after 10,000 costs only 1/10th of a cent; in this 15,000 name case, you would pay only $24.95! For 20,000 names,you would pay $19.95 plus an extra $10 (10,000 X 10 cents) All orders are shipped via 2-3 day priority mail, and come with a 30-day No Questions Asked Money Back Guarantee. Mail your check or M.O., in the amount of $19.95 plus any additional charges, along with your groups' description, to: ATS Publishers, Inc. 3811 Ditmars Blvd. Astoria, NY 11105 Tel: (718) 274-9060 If the line is busy, keep trying! We're trying to keep up with the enormous demand, since Thursday the 26th, our first mailing. Thank you so much for your time.

1 0

E-Cash IPO! PCweek Mag!
by Robert Hettinga 17 Dec '03

17 Dec '03

I'm sure they'll be hearing from Digicash, BV's trademark folks on this one... Cheers, Bob Hettinga --- begin forwarded text From: latham(a)softcell.net To: Date: Thu, 02 Jan 1997 02:11:04 PST Subject: E-Cash IPO! PCweek Mag! E-Cash IPO! 625,000 shares - $1.60 per share As seen in PCweek online magazine: http://www.pcweek.com/news/0826/27email.html "E-commerce startup offers digital cash to each user who retrieves advertising e-mail from its web site. Digital currency units can be converted into US dollars, Japanese yen, Swiss francs, and German marks." Millennium Interactive Technologies, developer of the first ever system of advertiser funded digital cash system. (DCU) is offering 625,000 common shares directly to the public. The offering price is $1.60 per share. Qualified investors can obtain a printed copy of the offering prospectus, demo disk, and additional info on how you can earn digital cash for looking at e-mail by sending reply to: mailto:latham@softcell.net --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox, e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/ FC97: Anguilla, anyone? http://offshore.com.ai/fc97/

1 0

Re: Hardening lists against spam attacks
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

At 09:28 AM 12/31/96 -0800, you wrote: : :So in order to post here, I hafta install and run PGP? Well, people :were looking for the perfect formula to deny service to guys like me, :and guess what? You found it! I will *not* install and run PGP. Fill me in. Why do you choose not to install and run PGP? Cordially, Alec PGP Fingerprint: Type bits/keyID Date User ID pub 1024/41207EE5 1996/04/08 Alec McCrackin <camcc(a)abraxis.com> Key fingerprint = 09 13 E1 CB B3 0C 88 D9 D7 D4 10 F0 06 7D DF 31

2 1

Re: Would you be interested in SPAM?
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

At 12:51 AM 1/1/97 GMT, you wrote: To cypherpunks(a)toad.com :You can save a substantial amount of money on your next Florida :Vacation and receive an adult pass to Universal Studios. : No adults here, Spamboy.

1 0

FIPS for AES
by John Young 17 Dec '03

17 Dec '03

Federal Register: January 2, 1997, Pages 93-94. Announcing Development of a FIPS for Advanced Encryption Standard Agency: NIST Notice; Request for comments. ----------------------------------------------------------------------- Summary: A process to develop a FIPS for Advanced Encryption Standard (AES) incorporating an Advanced Encryption Algorithm (AEA) is being initiated by the NIST. It is intended that the AES will specify an unclassified, publicly disclosed encryption algorithm capable of protecting sensitive government information well into the next century. [Described as a successor for DES by 1998.] ----- http://jya.com/aes010297.txt (8K)

2 1

Copyright violations
by alzheimer＠juno.com 17 Dec '03

17 Dec '03

Happy New Year. Associated Press: Monday, December 23, 1996 Three Credit Card Firms Seek To Promote Internet Shopping Three credit card companies on Monday announced an agreement on chip card standards in an effort to promote shopping on the Internet. Europay International, MasterCard International and Visa International said in a statement that they'll integrate in chip bank cards a technology developed for safe electronic payments. The agreement is based on the Europay-MasterCard-Visa specification, which established the financial industry's first global chip card payment infrastructure, and on MasterCard and Visa's Secure Electronic Transactions specification for magnetic stripe-based card transactions. Guido Heyns, director of 'smart card' development at Europay International, said in the statement that the Belgium-based company believes chip cards are the most secure and consumer-friendly solution for making payments on the Internet. Steve Mott, senior vice president of MasterCard International, agreed. 'Consumers and merchants want to conduct transactions over the Internet in a safe manner. By integrating chip and electronic commerce technologies, we are offering them the opportunity to do so as quickly and practically as possible.' An open comment period on the new standard will begin in the third quarter of 1997, according to the statement. American Banker: Monday, December 23, 1996 As the Technology Advances, Security Debate Still Rages By JEFFREY KUTLER In one of the more startling public statements by a banker in 1996, Citicorp chairman John Reed said it would take two generations -- 50 to 70 years -- for on-line electronic banking to gain full public acceptance. Taken out of context, his remarks to a Treasury Department conference on electronic money sounded like an invitation to complacency, or a dose of disinformation from one of the world's more aggressive purveyors of electronic financial services. But Mr. Reed chose his words carefully, citing a lesson learned from his 30-plus years at Citicorp: Banking markets, and society generally, take time to change. He seemed to suggest that high-technology advocates can become so enthralled with the elegance of their systems and convinced of their viability that they overlook the most common of all constraints: consumer behavior. "Privacy and security are at the top of the list" of consumers' concerns, the Citicorp chief executive said. "They won't deal with anyone who doesn't give them assurance." While "some early innovators will be your electronic banking customers," he said, "the average consumer is not there yet and isn't going to be there" for some time. "This is not a question of economics or efficiency. It is a question of trust. The consumer will have to trust you. The Internet is fundamentally flawed in that regard." Essentially alone among the major U.S. banking organizations, Citicorp has been openly wary of Internet security and refrained from joining the rush to interactive banking and monetary transactions via the World Wide Web. Mr. Reed and his senior technology officer, Colin Crook, have publicly expressed interest in and enthusiasm for the Web but not yet for transactional purposes. When Mr. Reed was asked during the Treasury conference in September when Citi would offer Internet banking, he replied, "Not until it's secure." "There is no absolute security," said Mr. Crook, perhaps the only banker raising concerns about an "information warfare" attack on the banking system. "It is a risk management issue." The Citibankers contend the risks of cyberspace are fundamentally different from those in other payment systems, and have yet to be addressed. "Security will be more demanding than even the government itself is used to," Mr. Crook said at the Treasury meeting serves more customers via personal computer than any other, through conventional dial-up connections and with software it developed more than a decade ago. Citibank also has placed a bet on a digital currency for on-line transactions, the invention of one of its own vice presidents, Sholom Rosen. The bank claims it will be more secure than competing alternatives like Cybercash Inc.'s Cybercoins, Digicash Inc.'s Ecash, and the Mondex smart-card-based system. Putting considerable prestige and intellectual firepower behind its cautionary principles, and behind the notion that the issuing of electronic currency should be reserved for regulated financial institutions, Citicorp has kept alive a debate that is likely to resound for months if not years in public policy circles, with effects not just on the battle for technical and competitive superiority but on the very consumer behavior Mr. Reed is trying to gauge. Consider some recent twists and turns: The U.S. government continues to struggle toward a policy on data encryption, the technology crucial to on-line transaction security, that would be agreeable to the high-tech community while addressing national security and law enforcement concerns. A May 1996 report by the National Research Council of the National Academy of Sciences -- Citicorp participated in and vocally endorsed the study -- criticized the government for being backward with its restrictions on encryption, particularly regarding its export. (See related article on page 14A.) Hewlett-Packard Co. in November announced its International Cryptography Framework, the first "strong encryption" method to get U.S. export clearance. While the framework is adaptable to various and changing government policies, it did not fully resolve the controversial issue of access to encryption keys. An information security team at the National Security Agency produced a monograph (excerpted at left) critical of the degree of anonymity built into Digicash's Ecash. The NSA, of course, is part of the establishment attacked in the National Research Council report. Digicash and Mondex, which is being taken over by MasterCard International, continually trade charges about their degrees of anonymity and security. Both sell anonymity of payments as a necessary analogue to cash. In that Digicash's anonymity appears more absolute, it may raise more governmental concerns. But Digicash, the brainchild of the renowned cryptologist David Chaum, accuses Mondex of not being "true electronic cash." First Virtual Holdings Inc., an Internet payment pioneer, does not trust Web security; its transaction data flow instead over private E-mail. By contrast, Cybercash Inc. chairman William Melton is so confident of the available technology that he tells bankers: "Security is essentially done. Just tell your customers, 'Don't worry, we'll take care of it.' " (He is more worried about privacy as a political flashpoint.) Enter the central banks of the Group of 10 industrialized countries, the constituents of the Bank for International Settlements in Basel, Switzerland. This august global regulatory body has signed off on a moderate, largely laissez-faire approach to the electronic evolution of money. A task force empaneled by the G-10's payment and settlement systems committee, which is headed by Federal Reserve Bank of New York president William McDonough, spelled out its conclusions in a 64-page booklet, "Security of Electronic Money," dated August 1996. The task force was generally impressed by existing security capabilities, particularly those incorporating hardware components like smart cards. The report took the eight-member task force less than a year to complete. Chairman Israel Sendrovic, the New York Fed's executive vice president of automation and systems services, asserts that this was no rush to judgment. He personally did due diligence on all of what he calls "the usual suspects" -- the electronic money schemes not mentioned by name in his report (but presumably in this article). In a recent interview, Mr. Sendrovic stressed that there are no absolutes. "There is no such thing as one secure measure," he said. "It's a combination of measures, and the combination of measures changes the risk management of an attack." His measured response to a lot of questions - pertaining to money laundering or the market potential of electronic currency and how it is to be regulated -- was, "It depends." He did say, in response to the recent flurry of questions about smart card security emanating from Bellcore and other research laboratories, that the cards were advertised as "tamper-resistant, not tamper- proof." Mr. Sendrovic said his panel has disbanded, satisfied with its work and having gotten positive feedback. "Then again, it didn't break new ground," he said. "Remember, it was designed not for the cognoscenti but for the Group of 10 governors. "We stay in close touch and follow these things," he said of the task force, adding that it may have cause to renew its inquiry in a year or two. Though the task force acknowledged "comprehensive security risk assessments of the entire system" are still lacking, it said they are within reach. And its words lacked the alarm or urgency of, say, the Citicorp contingent. Sholom Rosen, inventor of Citibank's Electronic Monetary System, characterized the risks as "very high" and not yet fully analyzed. Digital cash gains legitimacy when it is interchangeable with other forms of money, he said, but its interactions with those systems -- how an attack on one mechanism would affect others -- must be studied. And he said he believes the answers do not lie in technology alone but in the fundamentals of the "three pillars of security" -- prevention, detection, and containment. Where Mr. Rosen sees enormous hazard, Mr. Sendrovic retains faith in barriers to entry, as might be expected of someone who has worked with the dependable Fed Wire for many years. To be legitimate, electronic money "has to be cleared," he said. "At some point it has to get into the payment system." Is "the payment system" at risk of infection from the new forms of money? Based on what we know so far, it depends. ABA Banking Journal, 12/96 SMART CARDS POSE TAX PROBLEM FOR MERCHANTS A consensus is emerging that the success of smart cards hinges at least as much on merchants accepting them as on consumer acceptance. Increased tax liability is one reason for merchants' muted enthusiasm -- besides the fact that merchants are the only ones so far being asked to pay for using smart cards."There's a resistance to forms of payment besides cash," said Bruce Brittain, whose firm Brittain Associates, Inc., polled merchants that participated in the smart card test during the 1996 Summer Olympics in Atlanta. Some merchants admitted to understating their cash receipts so as to reduce their tax burden, he said. (Smart cards leave an electronic audit trail by recording deductions in card value each time merchandise is purchased.) On the flip side, franchisors may push for the adoption of smart cards in their stores, since some Atlanta operators told Brittain, "We want to collect more fees from our franchisees." (The franchisor's cut of the receipts will be reduced if the franchisee understates his receipts.) Other sources said they heard the same thing. The wish to under report receipts may pose a greater obstacle to smart cards when they undergo their next major test in New York City next year, because more "Mom and Pop" stores will be participating, Mr. Brittain said.

1 0

None One-time pads
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tim May is just a poor excuse for an unschooled, retarded thug. /''' c-OO Tim May \ -

1 0

Re: Hardening lists against spam attacks
by Hal Finney 17 Dec '03

17 Dec '03

I think this is an interesting theoretical discussion, although it's not clear whether it is actually a good idea to try implementing this. From: nobody(a)replay.com (Anonymous) > A very good scheme, but why not give each subscriber a token when s/he > subscribes? Something along the lines of: > > - - - - - - - - - - - - - - - - - - - - > Welcome to Cypherpunks. > > Your unique token is: 0A553FC1771623109504522E31C07F44 > > This token must appear either as the first line of the message body or in an > X-Token: header for any mail you send to the list. Any messages sent to the > list > address without this information will be discarded. > [...] > Bob wants to post something anonymously. His token isn't associated with his > user ID -- the only thing Majordomo knows about it is that it's in the token > file and it's flagged as active. He sends the message through the remailer > network with his token in it, and Majordomo validates it, strips it out, and > passes the message to the subscribers, decrementing the number of messages Bob > has remaining for that day. This requires Bob to trust the server to keep his identity secret. Although you _say_ that majordomo didn't associate the token with the userid, how does Bob know that? Certainly majordomo did, when Bob subscribed, see the association between the userid and the token. Now he has to trust that it has been forgotten. Even if it has, what about eavesdroppers on the list channel? What about the operator on the machine, who is peeking at what majordomo is doing? This mechanism will not provide enough anonymity for most posters. An alternative similar to what I proposed earlier is for majordomo to provide a blinded token, one which it doesn't see. This would be used specifically for anonymous postings. It does have the problem that it allows linking postings by the same pseudonymous nym - all will have the same token. But maybe we want to encourage that. (The full proposal I made involved use-once tokens, just like online digital cash, so that there would be no linkage and it would allow real anonymity.) > Mallory wants to spam the list. He subscribes and gets a token, which he > uses to > forward commercial announcements to the list. The list manager checks the logs > to see which token was used, and reduces its posting limit or invalidates it. > Mallory is no longer allowed to post, unless his token is reinstated (or he > unsubscribes and resubscribes). This unsubscribe/resubscribe issue has been mentioned before as a problem. I am not too concerned with it, for a few reasons. First, it may not be too difficult to recognize that it is happening. If the same user name is used we can prevent issuing new tokens on an unsubscribe/resubscribe cycle. If different user names are used but common domain names (an attack which many people could mount) we could recognize that with somewhat more difficulty, and mark those domains as special. Most people would have trouble getting lots of different accounts with different domain names. Eric Hughes maxim, "all crypto is economics", applies here. We can easily make it much more difficult for flooding attacks to occur. Hal

3 3